Processing requests at a remote service to implement local data classification

ABSTRACT

A client may send to a provider network a request to classify data at one or more data sources of the client network. The provider network receives the request and transmits the request to a local instance of a network-based data classification service at the client network. The local instance of the network-based data classification service classifies the data at the one or more data sources. The data is not exposed outside of a data isolation boundary associated with the client network during classification of the data by the local instance of the network-based data classification service. The provider network may initially provision the local instance of the network-based data classification service to run on the client network.

BACKGROUND

Remote data storage services are often used by organizations to storelarge amounts of generated data. For example, banks may store personaland financial data for customers at a remote provider network of aservice provider. Due to the massive amount customer data that is storedby a service provider on behalf of a client, the remote provider networkmay provide various software services to organize and manage the data.For example, remote software services may classify the data intodifferent categories, monitor usage of the data, and protect the datafrom unauthorized access. After customer data for a bank is uploaded toa remote provider network for storage, different portions of thecustomer data may be classified based on different levels ofsensitivity. For example, financial data such as credit card numbers maybe classified at a higher level of sensitivity than personal data suchas customer names.

Due to the highly confidential nature of certain types of data, a clientof a remote data storage service may decide to store some of its data onpremises instead of at the remote provider network. In some cases,regulations may require that a particular type of data must be stored onpremises (e.g., at a local client network) instead of being stored at aremote site. However, the client may have a large amount data storedamong various database systems throughout the local network. Therefore,it may be time-consuming for the client to locate different types ofdata and to identify whether the data, once located, can be transmittedto a remote provider network for storage or must remain on premises.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a system for classifying data at a client network,according to some embodiments.

FIG. 2 is a block diagram illustrating example components of a connecteddevice that implements a data classification engine, according to someembodiments.

FIG. 3 illustrates a system for classifying data at a client networkusing a device provided by a remote service provider, according to someembodiments.

FIG. 4 illustrates a system for classifying data at a client network viaa management interface of a remote provider network, according to someembodiments.

FIG. 5 illustrates a system for performing split data classificationbetween a classification service of a provider network and a local dataclassification service, according to some embodiments.

FIG. 6 is a flow diagram illustrating classifying data at a clientnetwork, according to some embodiments.

FIG. 7 is a flow diagram illustrating installing a local dataclassification service at a client network and classifying data usingthe local data classification service, according to some embodiments.

FIG. 8 is a flow diagram illustrating classifying data at a clientnetwork and transmitting some of the data to a remote storage servicebased on the sensitivity types of the classified data, according to someembodiments.

FIG. 9 is a flow diagram illustrating classifying data at a clientnetwork via a management interface of a remote provider network,according to some embodiments.

FIG. 10 is a flow diagram illustrating split data classification betweena classification service of a provider network and a local dataclassification service, according to some embodiments.

FIG. 11 is a block diagram illustrating an example computer system thatimplements some or all of the techniques described herein, according tosome embodiments.

While embodiments are described herein by way of example for severalembodiments and illustrative drawings, those skilled in the art willrecognize that embodiments are not limited to the embodiments ordrawings described. It should be understood, that the drawings anddetailed description thereto are not intended to limit embodiments tothe particular form disclosed, but on the contrary, the intention is tocover all modifications, equivalents and alternatives falling within thespirit and scope as defined by the appended claims. The headings usedherein are for organizational purposes only and are not meant to be usedto limit the scope of the description or the claims. As used throughoutthis application, the word “may” is used in a permissive sense (i.e.,meaning having the potential to), rather than the mandatory sense (i.e.,meaning must). Similarly, the words “include,” “including,” and“includes” mean including, but not limited to.

DETAILED DESCRIPTION OF EMBODIMENTS

The systems and methods described herein implement classifying data at aclient network based on a data classification service of a remoteprovider network. In embodiments, a computing device connected to aclient network implements a local data classification service. The localdata classification service provides an execution environment to run adata classification engine.

In some embodiments, the local data classification service receives arequest to classify data at one or more data sources of the clientnetwork. The request may be initiated from a client device of the clientnetwork according to a management interface for a data classificationservice of a remote provider network. For example, the parameters and/orthe format of the generated request may be the same as those that werepreviously used for requests to control the data classification serviceof a remote provider network. This may allow a user to easily transitionfrom using the data classification service of the remote providernetwork to using the local data classification service of the clientnetwork. Thus, in embodiments, the same application programminginterface (API) requests may be used to control the local dataclassification service as were previously used to control the dataclassification service of a remote provider network.

In response to receiving the request to classify data, the local dataclassification service may obtain some or all of the data from the oneor more data sources of the client network and classify the obtaineddata. In embodiments, the local data classification service may classifythe obtained data according to different types of sensitivity using thedata classification engine in the execution environment without the databeing exposed outside of a data isolation boundary of the clientnetwork. For example, policies or regulations may require that at leastsome of the data (e.g., sensitive data such as financial or health data)is not exposed outside of a data compliance boundary of the clientnetwork.

In some embodiments, a data classification service of a provider networkmay provision a local instance of the data classification service to runon a computing device of a remote client network. For example, theprovider network may download to a remote client network a dataclassification engine and an execution environment to run the dataclassification engine within the local instance of the network-baseddata classification service.

In embodiments, the data classification service of the provider networkreceives via a management interface a request from the client network toclassify data at one or more data sources of the client network. Thedata classification service of the provider network may then transmit(e.g., redirect) the request to the local instance of the dataclassification service at the remote client network. In embodiments,this may allow a user to easily transition from using the dataclassification service of the remote provider network to using the localdata classification service of the client network. Therefore, inembodiments, the same management interface at the remote providernetwork may be used to receive API requests to control the local dataclassification service at the client network and to receive API requeststo control the data classification service of the remote providernetwork.

In embodiments, a “connected device” or an “edge device” may refer tothe same type of internet-connectable device. In various embodiments, aconnected device or an edge device may refer to any type of computingdevice suitable for communicating, via one or more networks, with one ormore devices of a remote network (e.g., remote provider network) and/orany other devices of the same local network. Note that, in embodiments,a connected device may not always be connected to a provider networkand/or client network, yet still perform any of the describedfunctionality (e.g., data classification) and may transmit data to andfrom the provider network and/or client network once connectivity isre-established (e.g., in the event of a temporary disconnection). Inembodiments, an “endpoint” may be one or more computing devices and/orone more services that are part of a local network or a remote network,such that information may be transmitted to or from the endpoint via oneor more network connections. In some embodiments, machine learning maybe implemented using any suitable machine learning/artificialintelligence techniques (e.g., neural networks, deep neural networks,reinforcement learning, decision tree learning, genetic algorithms,classifiers, etc.).

By classifying data at a client network based on a data classificationservice of a remote provider network, various embodiments allow foradvantages over traditional techniques for classifying data at a clientnetwork. For example, a client of a service provider may wish toclassify data at its local network sending the data to a remote providernetwork and using a remote data classification service of the remoteprovider network. However, for various reasons, a portion of the datamay be required to remain at the local network and/or to remain within adata isolation boundary (e.g., to protect data and/or comply withpolicies/regulations).

Traditionally, the client may resort to manually classifying the portionof data, writing custom scripts to classify the portion of data, and/orusing a third-party tool. However, these options are time-consuming anderror-prone. For example, integrating new scripts and/or software toolswith existing software may introduce more errors, consume more computingand storage resources, and increase the time required to process andclassify data. Therefore, using the above techniques may not classifydata as accurately and/or as efficiently as the remote dataclassification service would have. Moreover, users may have to beundergo extensive training to implement a new process and/or use a newtool to classify data on premises, which may also be time-consuming andcause more classification errors.

The techniques described herein for classifying data at a client networkbased on a data classification service of a remote provider networkprovide solutions to the above problems. For example, the samemanagement interface and/or the same API requests may be used toclassify local data using a local data classification service at theclient network as is used to classify remote data using a remote dataclassification service at the client network. Therefore, a client mayquickly transition from using the remote data classification service tousing the local data classification service without causingclassification errors, without increasing time required to classifydata, and/or without consuming additional computing resources.Furthermore, a client may download from a provider network updates to aclassification model and apply those updates to a local model to improveaccuracy of data classification and reduce time required to classifydata. In some embodiments, the service provider may leverage datacollected from other clients as model training data, which is used toprovide the updates to the classification model.

FIG. 1 illustrates a system for classifying data at a client network,according to some embodiments. The connected devices 100 depicted inFIG. 1 may be the same type of connected device, and include some or allof the same components as other connected devices depicted in FIGS. 1-4,in embodiments. Although certain components of the provider network 102,the data classification service 104, and/or the local dataclassification service 106 are described as performing various actionsin FIGS. 1-4, any of those actions may be performed by any hardwareand/or software component of the provider network 102, the dataclassification service 104, the local data classification service 106,or any other components of the networks in FIGS. 1-4.

In the depicted embodiment, the data classification service 104 includesa management interface 108 and a provisioning manager 110. The providernetwork 102 also includes a storage service 112 and a database service114. Any of the above service may be used by the client network 116and/or one or more other client networks 118. As shown, the providernetwork 102 may transmit data to and from devices of any of the clientnetworks 116, 118 via a wide-area network 120 (e.g., the Internet).

As shown, the local data classification service 106 may include anynumber of connected devices 100. Each connected device may include anexecution environment 122 that runs a data classification engine 124.Each connected device also includes a management interface 126 formanaging the local data classification service 106 and/or components ofthe local data classification service 106. In embodiments, the dataclassification engine 124 includes one or more models that areimplemented by the execution environment 122 and/or the dataclassification engine 124 to classify data. In some embodiments, thedata classification engine 124 includes a machine learning framework forimplementing the one or more models. The client network 116 alsoincludes a management device 128 and one or more data sources 130 (e.g.,databases and/or any other suitable structures for storing data).

In some embodiments, two or more of connected devices 100 may includethe same data classification engines 124 and/or the same data model forprocessing data. Therefore, multiple classification engines may classifydata in parallel to increase a rate that an amount of data classified.In some embodiments, one or more of the data classification engines 124and/or the data models may be different than any number of other ones ofthe data classification engines 124 and/or the data models. In suchembodiments, different data classification engines 124 and/or datamodels may produce different classification results for the same portionof data. Therefore, although the local data classification service maybe described herein as implemented by one connected device, in otherembodiments any other number of connected devices may implement thelocal data classification service.

In embodiments, the local data classification service 106 receives arequest to classify data at one or more data sources 130 of the clientnetwork 116. The request may be initiated from a client device (e.g.,management device 128) of the client network according to a managementinterface for a data classification service of a remote providernetwork. Therefore, the request may be initiated and/or generated in thesame way as a request for the data classification service 104 toclassify data at one or more data sources. Thus, a user may use themanagement device 128 (e.g., via a graphical user interface and/orcommand line interface) to provide input to initiate the request. Inembodiments, the user may select one or more of the data sources using agraphical user interface and/or command line interface.

In some embodiments, the management device transmits the request to themanagement interface 126 a of the local data classification service 106.Therefore, the management interface 126 a receive from the managementdevice 128 the request to classify data at one or more of the datasources 130.

In another embodiment, the management device instead transmits therequest to the management interface 108 of the data classificationservice 104 of the provider network 102. The management interface 108then transmits and/or re-directs the request to the management interface126 a of the local data classification service 106. In embodiments, therequest may be processed and/or modified before the request istransmitted and/or re-directed to the management interface 126 a of thelocal data classification service 106. For example, a format of therequest may be changed. In some embodiments, the request is receivedfrom the client may be in accordance with one network communicationprotocol (e.g., hyper-text transport protocol (HTTP)), and the requestis modified and transmitted to the management interface 126 a of thelocal data classification service 106 in accordance with another networkcommunication protocol (e.g., message queuing telemetry transport(MQTT)). In embodiments, HTTP, MQTT, and/or any other suitable networkcommunication protocol may be used by any of the devices herein tocommunicate with another device.

In some embodiments, the data classification service 104 of the providernetwork 102 may provide various data management tools that allow aclient user to easily identify the locations of data that has and/or hasnot yet been classified. For example, the user may then select one ormore of the locations for the local data classification service 106 toobtain data from and to classify.

In an embodiment, the data classification service 104 of the providernetwork 102 may receive via the management interface 108 a request fromthe management device 128 to provide locations of data sources of theclient that have data that has not yet been classified or is availableto be classified. The data classification service 104 of the providernetwork 102 may determine one or more data sources of the client thateach have data that has not yet been classified or is available to beclassified (e.g., data sources at the client network 116, providernetwork 102, and/or one or more other networks at one or more differentgeographic locations).

In embodiments, the data classification service 104 of the providernetwork 102 may then provide to the management device 128 an indicationof the different data sources of the client that each have data that hasnot yet been classified or is available to be classified. Inembodiments, the management device 128 may display on a graphical userinterface a list or map that indicates data sources at the clientnetwork 116, provider network 102, and/or one or more other networks atone or more different geographic locations.

In some embodiments, the indication provided to the management device128 may depend on one or more factors. The indication may be based onone or more of a geographic location of a client device that submittedthe request, a user (e.g., permissions assigned to the user) thatsubmitted the request, and a type (e.g., permissions assigned to thetype) of the client device that submitted the request. For example, auser in the United States may be provided certain data sources locatedin the United States but not provided certain data sources located inanother country. In some cases, some data sources are provided and someare not provided, based on the user having certain access permissionsand/or using a type of client device (e.g., smart phone or on-premisesserver).

In various embodiments, a client may use the data classification serviceof the provider network to classify data at the provider network in asame or similar way as the client uses the local data classificationservice to classify data at the client network. Thus, a client user mayuse the same management device 128 to classify data at the providernetwork and/or the client network. For example, the data classificationservice 104 of the provider network 102 may receive via the managementinterface 108 a request from the management device 128 to classify dataat one or more data sources at the provider network, wherein the requestindicates at least the one or more data sources. The data classificationservice 104 of the provider network 102 may then obtain some or all ofthe data from the one or more other data sources of the provider networkand classify the obtained data according to different types ofsensitivity using a data classification engine (e.g., using one or moredata classification models) of the provider network.

In embodiments, the execution environment, the data classificationengine, the management interface, the connected device, and/or any othercomponents of the local data classification service may be obtained fromthe remote provider network. For example, the provisioning manager 110may download to the client network and/or the connected device 100 a theexecution environment, the data classification engine, the managementinterface, and/or any other components of the local data classificationservice.

In some embodiments, the service provider may provision the connecteddevice 100 a and then ship/send the connected device 100 a to the client(e.g., a client site that may include the client network). Thus, incertain embodiments, the connected device may be a shippable storagedevice that includes a data store. For example, the provisioning manager110 may provision the connected device 100 a at the provider network viaa physical, internet, and/or wireless connection to the connected device100 a. To provision the connected device 100 a, the provisioning manager110 may download and/or install the execution environment, the dataclassification engine, the management interface, and/or any othercomponents of the local data classification service to the connecteddevice 100 a. The connected device 100 a may then be shipped to theclient.

In embodiments, after classifying obtained data as described herein, thelocal data classification service of the shippable storage device maystore some portions of the obtained data at the data store of theshippable storage device based on the different types of sensitivityclassifications for different portions of the obtained data. The localdata classification service may then provide to the client network(e.g., the client management device) or to the provider network (e.g.,to the management interface and/or the data classification service) anindication that the one or more portions of the obtained data have beenclassified and stored at the data store of the shippable storage device(and that the shippable storage device is ready to be shipped back tothe service provider and/or provider network).

In embodiments, the client may then disconnect the shippable storagedevice and ship it back to the service provider and/or provider network(or any other location associated with a storage service provider). Theclassified data may then be ingested by a storage service of theprovider network/storage service provider. In some embodiments, some orall of the classified data is encrypted by the shippable storage device(e.g., by the local data classification service) before it is stored atthe data store in encrypted form. This technique may allow a client totransfer extremely large quantities of data to a storage service at afaster rate than would otherwise be possible using data transmissionover the internet. This may also provide a more secure method fortransferring data, since there is not electronic data transmissions thatmay be intercepted or received by unauthorized recipients.

In various embodiments, the local data classification service 106 may beconsidered an “event-driven” service, since the service may invokeand/or execute functions in response to detecting associated events, asdiscussed herein (e.g., receiving data, receiving requests to classifydata, or any other suitable trigger). For example, the function mayexecute the data classification engine 124. In embodiments, the localdata classification service 106 includes a function that is registeredfor invocation in the execution environment in response to detection ofa defined event (e.g., receiving a request to classify data at one ormore data sources). When the local data classification service 106detects the event, the service 106 invokes the function. The functionthen executes the data classification engine 124 in the executionenvironment 122 to classify the obtained data.

In various embodiments, an execution environment 122 may include a javavirtual machine capable of executing a function registered with thelocal data classification service 106. In embodiments, an executionenvironment may be any other type of execution environment capable ofexecuting a registered function.

In embodiments, the execution environment may terminate the functionand/or data classification engine upon completion of one or more tasksresponsive to the event (e.g., classifying obtained data). Inembodiments, this may reduce computing resource usage, because functionsand associated resources to run the functions will only be used whenresponding to events. In some embodiments, to improve data security forthe obtained data and/or to free up computing resources, the local dataclassification service does not save any execution state or any of theobtained data when the registered function is terminated.

FIG. 2 is a block diagram illustrating example components of a connecteddevice that implements a data classification engine, according to someembodiments. In the depicted embodiment, the connected device 100includes operating memory 200 (e.g., volatile memory and/or non-volatilememory), a processor 202 (e.g., CPU), data storage 204, other resources206 (e.g., GPUs, FPUs, etc.), and a network interface 208. Inembodiments, the connected device 100 may include one or more additionalmemories and/or processors.

In some embodiments, the other resources 206 may include non-volatilememory that stores code for executing the local data classificationservice 106 and/or any components of the local data classificationservice 106. In some embodiments, the local data classification service106 and/or any components of the local data classification service 106may be loaded into the operating memory 200 (e.g., after reboot or powerfailure).

The operating memory implements various components of the local dataclassification service 106, including the execution environment 122suitable for running the data classification engine 124, which mayinclude a data classification model 210. In embodiments, the dataclassification engine 124 includes a machine learning framework. Asdepicted, the local data classification service 106 also includes amanagement interface 126, a data discovery manager 212, a reportgenerator 214, and a user behavior analyzer 216, described in moredetail below.

In embodiments, the execution environment may provide for event-drivenexecution of one or more functions, including one or more functions toexecute the data classification engine to classify data obtained fromone or more data sources 130. For example, a function may be invoked inresponse to the local data classification service 106 (e.g., executionenvironment 122) detecting a defined triggering event. In embodiments,the defined triggering event may be receiving a portion of data from theone or more data sources 130 and/or receiving by the local dataclassification service 106 a request to classify data obtained from oneor more data sources 130.

When the function is invoked, the execution environment 122 may executethe data classification engine 124 and/or the model 210 to classify theobtained data to generate results. In embodiments, the results mayinclude an indication of a storage location and type of sensitivity forone or more respective portions of data. For example, the results mayindicate/identify a particular database as a storage location for afirst portion of data and indicate/identify the first portion of data ashaving high sensitivity (e.g., bank account number) and the results mayindicate/identify a different database as a storage location for asecond portion of the data and indicate/identify the second portion ofdata as having a lower sensitivity than the first portion (e.g.,customer name). In embodiments, the local data classification servicemay perform one or more actions based on the received results (e.g.,issue one or more commands to another client device of the clientnetwork or provide an indication of the results to a graphical userinterface of a client device of the client network).

In embodiments, the network interface 208 communicatively couples theconnected device 100 to the local network. Thus, the connected device100 transmits data to and/or receives data from one or more other datasource devices, connected devices, the machine learning deploymentservice 104, or other endpoints of the provider network 102 or clientnetworks 116 via the network interface 208. In embodiments, the networkinterface 208 may transmit and receive data via a wired or wirelessinterface.

In various embodiments, the connected device 100 may provide high levelsof security (e.g., encrypted messages) to protect data beingcommunicated between connected devices and also between the connecteddevice and the provider network 102. The connected device may provide asimple yet powerful processor and/or operating system to provideplatform-agnostic capabilities. In some embodiments, the size of one ormore memories and/or one or more processors used by one or more serversof the provider network 102 to implement services (e.g., dataclassification service 104) may be at least an order of magnitude largerthan the size of the memory and/or the processor used by the connecteddevice 100. However, the connected device 100 may still be powerfulenough to run a same or similar execution environment 122 as one thatruns on one or more servers of the provider network 102, in order toexecute the same data classification engine, model, and/or event-drivenfunctions.

FIG. 3 illustrates a system for classifying data at a client networkusing a device provided by a remote service provider, according to someembodiments. As shown, the provider network 102 also includes a dataingestion service 302. As described below, the data ingestion service302 may ingest data from a storage device at the provider network 102.

In the depicted embodiment, the connected device 100 is provisioned bythe service provider at the provider network 102. As described above,the service provider may provision the connected device 100 a at theprovider network 102 and then ship/send the connected device 100 a tothe client. The provisioning manager 110 may download and/or install theexecution environment, the data classification engine, the managementinterface, and/or any other components of the local data classificationservice to the connected device 100 a. The connected device 100 a maythen be shipped to the client.

When the client receives the connected device 100, it is connected tothe client network via a physical, internet, and/or wireless connection.Any of various authentication methods may be employed to authorizeand/or verify that the connected device was sent from the serviceprovider and has not been tampered with or modified.

In the example embodiment, the connected device 100 and components ofthe client network 116 are within a data isolation boundary 304. Inembodiments, data (or data of a certain type of sensitivity) within thedata isolation boundary may be prevented from being exposed outside ofthe data isolation boundary 304. For example, local data classificationservice 106 and components of the client network 116 may be configuredto store and/or process data without the data being exposed outside ofthe data isolation boundary.

In some embodiments, some devices and/or data sources of the clientnetwork may be within the data isolation boundary and others may not.Therefore, in some cases only a sub-network of the client network 116may be within the data isolation boundary. The data isolation boundarymay include one or more organizations, local networks, or geographicalareas (e.g., city, state, country, etc.).

In embodiments, the client may define the data isolation boundary and/orset policies to determine which types of data are to remain within thedata isolation boundary. In embodiments, an external organization maymaintain or establish guidelines to determine which types of data are toremain within the data isolation boundary. For example, guidelines maydictate that certain types of credit card data or health data mustremain within the data isolation boundary.

In various embodiments, before the local data classification service 106can obtain data to classify, the data discover manager 212 may first beused to discover the one or more data sources of the client network 116.In embodiments, the management interface 126 may receive a request fromthe management device 128 to discover data sources of the clientnetwork. In response, the data discovery manager 212 discovers (e.g.,crawls the network to identify) some or all of the data sources 130 ofthe client network that include data to be classified or capable ofbeing classified by the local data classification service 106. Anysuitable technique may be used to discover the data sources. Forexample, the local data classification service 106 may implementdifferent data connectors to interface with different types of datasources (e.g., databases, file systems, etc.).

As described above, the local data classification service 106 may obtaindata and classify the obtained data to generate results. The results mayinclude an indication of a storage location that each portion of theobtained data was obtained from and a type of sensitivity (e.g.,sensitivity level or sensitivity category) for each portion of theobtained data. In embodiments, any suitable number or label (e.g., “1”or “low”) may be used to indicate sensitivity of a portion of data(e.g., as metadata associated with or stored with the portion of data).For example, one portion of data may be assigned “1” or “low” toindicate it is classified at a lower sensitivity than another portion ofdata assigned “3” or “high.” Any number of different levels ofsensitivity may be assigned to a given portion of data, in embodiments.In embodiments, after classifying the obtained data, the reportgenerator 214 generates a report based on the results.

The report may indicate different sensitivity classifications (e.g., viaassociated metadata) for different portions of the obtained data. Thereport may also indicate the location that each portion of the obtaineddata was obtained from (e.g., which data sources each portion of theobtained data was obtained from). In embodiments, some or all of thedata sources still retain a copy of any data that was obtained by thelocal data classification service 106.

In embodiments, based on the report, the local data classificationservice 106 may determine that one or more portions of the obtained datamay be transmitted to the provider network for storage (e.g., at thestorage service 112). For example, the local data classification servicemay determine that a first set of data that was classified as having lowsensitivity (e.g., below a threshold level of sensitivity) may betransmitted to the provider network for storage. However, the local dataclassification service may determine that a second set of data that wasclassified as having a higher sensitivity (e.g., at or above thethreshold level of sensitivity) may not be transmitted to the providernetwork for storage.

In various embodiments, data that is received by the provider network102 (e.g., by the data classification service 104) may be flagged toindicate that it has already been classified. This may eliminate anyunnecessary processing or classification of data, saving computeresources. For example, the data classification service 104 may receivefrom the local instance of the network-based data classification service106 portions of data from the data sources 130 and metadata thatindicates the received portions data have already been classified by thelocal instance of the network-based data classification service 106.

In some embodiments, the local data classification service may store thefirst set of data storage 204 (e.g., non-volatile storage memory) of thelocal data classification service. The local data classification servicemay encrypt the data using one or more keys associated with an accountof the client (e.g., keys that are also maintained by the providernetwork on behalf of the client). After data classification at theclient network is complete, the connected device may be disconnectedfrom the client network and shipped back to the service provider.

In embodiments, when the service provider receives the connected device100, it is connected to the provider network via a physical, internet,and/or wireless connection. Any of various authentication methods may beemployed to authorize and/or verify that the connected device was sentfrom the client and has not been tampered with or modified.

The data ingestion service 302 may then obtain the data from theconnected device and store the data at the storage service. Inembodiments, the data ingestion service may decrypt the data as part ofthe ingestion process. For example, the data may be decrypted using theone or more keys associated with an account of the client.

FIG. 4 illustrates a system for classifying data at a client network viaa management interface of a remote provider network, according to someembodiments. As depicted, the client network 116 is included within adata isolation boundary 402. Therefore, some or all data within the dataisolation boundary 402 is prevented from being exposed to any devices ornetworks outside of the boundary, include the provider network 102.However, management requests (e.g., API request) may still be sent tothe provider network.

As shown, the data classification service 104 of the provider networkmay receive via a management interface 108 a request from the clientnetwork to classify data at one or more data sources 130 of the clientnetwork. The data classification service of the provider network maythen transmit the request to the local instance of the dataclassification service 106 at the remote client network. As describedabove, the local instance of the data classification service 106 maythen obtain data and classify the obtained data according to differenttypes of sensitivity.

Note that in some embodiments, the same management interface 108 at theremote provider network may be used to receive API requests to controlthe local data classification service 106 at the client network and toreceive API requests to control the data classification service 104 ofthe remote provider network. Therefore, a user at the client network mayselect the data classification service of the remote provider network104 to classify remote data (e.g., data transmitted from the clientnetwork that has not yet been classified) or may select the local dataclassification service 106 to classify local data at the client network.

In embodiments, any other components of the local instance of the dataclassification service 106 may be controlled and/or used via requests(e.g., API requests) from the client network that are sent to themanagement interface 108 and routed back down to the local dataclassification service 106. For example, the data classification serviceof the remote provider network 104 may receive via the managementinterface 108 a request from the client network to discover data sourcesof the client network. In response, the management interface 108 maytransmit the request to the local data classification service 106 (e.g.,to the data discovery manager 212). The data discovery manager 212 maythen discover data and/or data sources at the client network (e.g., asdescribed above).

In embodiments, the user behavior analyzer 216 may be used to monitordata usage at some or all of the data sources. Based on the data usage,the user behavior analyzer 216 may generate an alert. For example, ifthe user behavior analyzer 216 determines that data access patternsindicate unauthorized access of data or a breach of secured data, thenuser behavior analyzer 216 may alert one or more users. For example analert message may be transmitted to the management device 128 and/orother computing devices of the client network. The alert may indicatethe data that was accessed and/or the user that accessed the data. Inembodiments, the user behavior analyzer 216 may monitor data that hasbeen classified by the data classification engine as being assigned alevel of sensitivity above a threshold level.

FIG. 5 illustrates a system for performing split data classificationbetween a classification service of a provider network and a local dataclassification service, according to some embodiments. As depicted, theclient network 116 is included within a data isolation boundary 402.Therefore, some or all data within the data isolation boundary 402 isprevented from being exposed to any devices or networks outside of theboundary, include the provider network 102. However, management requests(e.g., API request) may still be sent to the provider network.

As shown, the data classification service 104 of the provider networkincludes a data classification model 502, a local model generator 504,and a management interface 108. As described below, in some embodiments,the local model generator 504 may generate a local classification model506 for deployment to the client network.

In embodiments, the local data classification service 106 receives arequest to classify data at data sources of the client network 116. Thelocal data classification service 106 may obtain data from the datasources of the client network. The local data classification service 106may then process the data using the local classification model 506 togenerate intermediate results without the data being exposed outside ofthe data isolation boundary 402. In embodiments, the processing of thedata may include one or more initial operations to classify the obtaineddata to generate intermediate results. In embodiments, the intermediateresults does not expose some or all of the obtained data. In otherwords, some or all of the obtained data cannot be determined based onthe intermediate results (e.g., due to anonymizing of data, obfuscationof data, removal of personally identifiable information or othersensitive data, etc.).

In various embodiments, the local data classification service 106 maythen send the intermediate results to the data classification service104 of the provider network 102. The data classification service 104 maythen process the intermediate results using the classification model 502to generate data classification results. These classification resultsmay then be transmitted to the local data classification service 106and/or another endpoint at the client network 116, the provider network102, or other network.

In some embodiments, the available computing power of the dataclassification service 104 of the provider network 102 is much morepowerful than that the available computing power of the local dataclassification service 106. For example, processors and/or memory may befaster and/or larger (e.g., at least by several orders of magnitude).Therefore, a client may send the intermediate classification results tothe provider network for final stages of classification processing toachieve faster and/or more accurate data classification results thanwould be obtained if all of the classification processing were performedat the client network. In embodiments, this technique allows a client toleverage the computing power of the provider network, while stillpreventing some or all of the obtained data (e.g., sensitive data) frombeing exposed outside of a data isolation boundary.

In some embodiments, a client may leverage data that has been collectedand stored at multiple different locations (e.g., different networks,different cities, countries, etc.) in order to train models forclassifying data at a particular location (e.g., client network 116). Asdepicted, the local model generator 504 may obtain training data fromone or more data sources of the client, which may include data sourcesat the client network 116, data sources at the provider network 102, anddata sources at another remote network other than the client network 116(e.g., other networks owned or managed by the client).

In embodiments, the local model generator 504 may then train the localclassification model 506 based on the above obtained data and send thetrained local classification model 506 to the local data classificationservice 106. Thus, the local classification model 506 may be trainedand/or configured to be used by the local data classification service106 to classify data at the client network 116. In embodiments, byleveraging the much larger training data set at the provider network togenerate the local classification model 506, more accurate dataclassification results may be obtained than would be obtained if thetraining data set were only based on data from the client network 116and/or other generic training data. Moreover, the client may leveragethe computing power of the provider network to generate a localclassification model faster than it could be generated locally.

FIG. 6 is a flow diagram illustrating classifying data at a clientnetwork, according to some embodiments.

At block 602, a data classification service of a remote provider networkprovisions a local data classification service to run on a computingdevice of a client network. At block 604, the local data classificationservice receives a request to classify data at data sources of theclient network, wherein the request is initiated from a client device onthe client network according to a management interface for a dataclassification service of a remote provider network.

At block 606, the local data classification service obtains data fromthe data sources of the client network. At block 608, the local dataclassification service classifies the obtained data according tosensitivity types without the data being exposed outside of a dataisolation boundary.

FIG. 7 is a flow diagram illustrating installing a local dataclassification service at a client network and classifying data usingthe local data classification service, according to some embodiments.

At block 702, the client network downloads components for a local dataclassification service. At block 704, the client installs the local dataclassification service on the client network. At block 706, the localdata classification service discovers data sources on the clientnetwork.

At block 708, the local data classification service receives a requestto classify data at one or more of the discovered data sources. At block710, the local data classification service classifies the data accordingto different sensitivity types without the data being exposed outside ofa data isolation boundary.

FIG. 8 is a flow diagram illustrating classifying data at a clientnetwork and transmitting some of the data to a remote storage servicebased on the sensitivity types of the classified data, according to someembodiments.

At block 802, the local data classification service classifies dataaccording to sensitivity types. At block 804, the local dataclassification service generates a report indicating differentsensitivity types for different portions of the data. At block 806, thelocal data classification service transmits one or more portions of thedata to a remote storage service based on the sensitivity typesindicated for the data.

FIG. 9 is a flow diagram illustrating classifying data at a clientnetwork via a management interface of a remote provider network,according to some embodiments.

At block 902, a remote data classification service of a remote providernetwork provisions a local instance of a data classification service torun on a computing device of a client network. At block 904, amanagement interface of the remote data classification service receivesfrom the client network a request to classify data at data sources ofthe client network.

At block 906, the management interface of the remote data classificationservice transmits, to the computing device running the local instance ofthe data classification service, the request to classify the datasources. In embodiments, the data being classified is not exposedoutside of a data isolation boundary during classification of the data.

FIG. 10 is a flow diagram illustrating split data classification betweena classification service of a provider network and a local dataclassification service, according to some embodiments.

At block 1002, a local data classification service receives a request toclassify data at data sources of the client network. At block 1004, thelocal data classification service obtains data from the data sources ofthe client network. At block 1006, the local data classification serviceprocesses the data using the local classification model to generateintermediate results without the data being exposed outside of the dataisolation boundary.

At block 1008, the local data classification service sends theintermediate results to the data classification service of the providernetwork. At block 1010, the data classification service processes theintermediate results using a classification model to generate dataclassification results. At block 1012, these data classification resultsmay then be provided to the client network (e.g., to the local dataclassification service). In embodiments, the local data classificationservice may perform one or more actions based on the received results(e.g., issue one or more commands to another client device of the clientnetwork).

Any of various computer systems may be configured to implement processesassociated with classifying data at a client network based on a dataclassification service of a remote provider network. For example, FIG.11 is a block diagram illustrating one embodiment of a computer systemsuitable for implementing at least some of the systems and methodsdescribed herein. In various embodiments, the connected devices 100,computing devices that implement services of the provider network 102 orclient network 116, and/or any other described components may eachinclude one or more computer systems 1100 such as that illustrated inFIG. 11 or one or more components of the computer system 1100 thatfunction in a same or similar way as described for the computer system1100.

In the illustrated embodiment, computer system 1100 includes one or moreprocessors 1110 coupled to a system memory 1120 via an input/output(I/O) interface 1130. Computer system 1100 further includes a networkinterface 1140 coupled to I/O interface 1130. In some embodiments,computer system 1100 may be illustrative of servers or other computingdevices implementing a data classification service, while in otherembodiments servers may include more, fewer, or different elements thancomputer system 1100.

In various embodiments, computer system 1100 may be a uniprocessorsystem including one processor 1110, or a multiprocessor systemincluding several processors 1110 (e.g., two, four, eight, or anothersuitable number). Processors 1110 may be any suitable processors capableof executing instructions. For example, in various embodiments,processors 1110 may be embedded processors implementing any of a varietyof instruction set architectures (ISAs), such as the x86, PowerPC,SPARC, or MIPS ISAs, or any other suitable ISA. In multiprocessorsystems, each of processors 1110 may commonly, but not necessarily,implement the same ISA.

System memory 1120 may be configured to store instructions and dataaccessible by processor 1110. In various embodiments, system memory 1120may be implemented using any suitable memory technology, such as staticrandom access memory (SRAM), synchronous dynamic RAM (SDRAM),non-volatile/Flash-type memory, or any other type of memory. In theillustrated embodiment, program instructions and data implementingdesired functions, such as those methods and techniques described abovefor the data classification service are shown stored within systemmemory 1120 as program instructions 1125 (e.g., local dataclassification service 1195 at a client network and/or a dataclassification service at the provider network). In some embodiments,system memory 1120 may include data 1135 which may be configured asdescribed herein.

In one embodiment, I/O interface 1130 may be configured to coordinateI/O traffic between processor 1110, system memory 1120 and anyperipheral devices in the system, including through network interface1140 or other peripheral interfaces. In some embodiments, I/O interface1130 may perform any necessary protocol, timing or other datatransformations to convert data signals from one component (e.g., systemmemory 1120) into a format suitable for use by another component (e.g.,processor 1110). In some embodiments, I/O interface 1130 may includesupport for devices attached through various types of peripheral buses,such as a variant of the Peripheral Component Interconnect (PCI) busstandard or the Universal Serial Bus (USB) standard, for example. Insome embodiments, the function of I/O interface 1130 may be split intotwo or more separate components, such as a north bridge and a southbridge, for example. Also, in some embodiments, some or all of thefunctionality of I/O interface 1130, such as an interface to systemmemory 1120, may be incorporated directly into processor 1110.

Network interface 1140 may be configured to allow data to be exchangedbetween computer system 1100 and other devices attached to a network,such as between the connected device 100 and other computer systems, forexample. In particular, network interface 1140 may be configured toallow communication between computer system 1100 and/or various I/Odevices 1150. I/O devices 1150 may include scanning devices, displaydevices, input devices and/or other communication devices, as describedherein. Network interface 1140 may commonly support one or more wirelessnetworking protocols (e.g., Wi-Fi/IEEE 802.9, or another wirelessnetworking standard). However, in various embodiments, network interface1140 may support communication via any suitable wired or wirelessgeneral data networks, such as other types of Ethernet networks, forexample. Additionally, network interface 1140 may support communicationvia telecommunications/telephony networks such as analog voice networksor digital fiber communications networks, via storage area networks suchas Fibre Channel SANs, or via any other suitable type of network and/orprotocol.

In some embodiments, system memory 1120 may be one embodiment of acomputer-accessible medium configured to store program instructions anddata as described above. However, in other embodiments, programinstructions and/or data may be received, sent or stored upon differenttypes of computer-accessible media. Generally speaking, acomputer-accessible medium may include computer-readable storage mediaor memory media such as magnetic or optical media, e.g., disk orDVD/CD-ROM coupled to computer system 1100 via I/O interface 1130. Acomputer-readable storage medium may also include any volatile ornon-volatile media such as RAM (e.g. SDRAM, DDR SDRAM, RDRAM, SRAM,etc.), ROM, etc., that may be included in some embodiments of computersystem 1100 as system memory 1120 or another type of memory. Further, acomputer-accessible medium may include transmission media or signalssuch as electrical, electromagnetic, or digital signals, conveyed via acommunication medium such as a network and/or a wireless link, such asmay be implemented via network interface 1140.

In some embodiments, I/O devices 1150 may be relatively simple or “thin”client devices. For example, I/O devices 1150 may be configured as dumbterminals with display, data entry and communications capabilities, butotherwise little computational functionality. However, in someembodiments, I/O devices 1150 may be computer systems configuredsimilarly to computer system 1100, including one or more processors 1110and various other devices (though in some embodiments, a computer system1100 implementing an I/O device 1150 may have somewhat differentdevices, or different classes of devices).

In various embodiments, I/O devices 1150 (e.g., scanners or displaydevices and other communication devices) may include, but are notlimited to, one or more of: handheld devices, devices worn by orattached to a person, and devices integrated into or mounted on anymobile or fixed equipment, according to various embodiments. I/O devices1150 may further include, but are not limited to, one or more of:personal computer systems, desktop computers, rack-mounted computers,laptop or notebook computers, workstations, network computers, “dumb”terminals (i.e., computer terminals with little or no integratedprocessing ability), Personal Digital Assistants (PDAs), mobile phones,or other handheld devices, proprietary devices, printers, or any otherdevices suitable to communicate with the computer system 1100. Ingeneral, an I/O device 1150 (e.g., cursor control device, keyboard, ordisplay(s) may be any device that can communicate with elements ofcomputing system 1100.

The various methods as illustrated in the figures and described hereinrepresent illustrative embodiments of methods. The methods may beimplemented manually, in software, in hardware, or in a combinationthereof. The order of any method may be changed, and various elementsmay be added, reordered, combined, omitted, modified, etc. For example,in one embodiment, the methods may be implemented by a computer systemthat includes a processor executing program instructions stored on acomputer-readable storage medium coupled to the processor. The programinstructions may be configured to implement the functionality describedherein (e.g., the functionality of the connected devices, variousservices or components of the provider network, client network,databases, devices and/or other communication devices, etc.).

Various modifications and changes may be made as would be obvious to aperson skilled in the art having the benefit of this disclosure. It isintended to embrace all such modifications and changes and, accordingly,the above description to be regarded in an illustrative rather than arestrictive sense.

Various embodiments may further include receiving, sending or storinginstructions and/or data implemented in accordance with the foregoingdescription upon a computer-accessible medium. Generally speaking, acomputer-accessible medium may include storage media or memory mediasuch as magnetic or optical media, e.g., disk or DVD/CD-ROM, volatile ornon-volatile media such as RAM (e.g. SDRAM, DDR, RDRAM, SRAM, etc.),ROM, etc., as well as transmission media or signals such as electrical,electromagnetic, or digital signals, conveyed via a communication mediumsuch as network and/or a wireless link.

What is claimed is:
 1. A system, comprising: one or more computingdevices of a provider network comprising respective processors andmemory to implement a network-based data classification service to:provision a local instance of the network-based data classificationservice to run on a computing device of a remote client network; receivevia a management interface of the network-based data classificationservice a request from the client network to classify data at one ormore data sources of the client network, wherein the request indicatesat least the one or more data sources; and transmit to the computingdevice running the local instance of the network-based dataclassification service at the remote client network the request toclassify the data at the one or more data sources, wherein at least someof the data is not exposed outside of a data isolation boundaryassociated with the client network during classification of the data bythe local instance of the network-based data classification service. 2.The system as recited in claim 1, wherein the network-based dataclassification service is configured to: receive via the managementinterface of the network-based data classification service a requestfrom the client network to provide locations of data sources of theclient that have data that has not yet been classified or is availableto be classified; determine a plurality of data sources of the clientthat each have data that has not yet been classified or is available tobe classified; and provide to the client network an indication of theplurality of data sources of the client that each have data that has notyet been classified or is available to be classified, wherein theplurality of data sources comprises: one or more client data sourceslocated at the provider network; and one or more client data sourceslocated at the client network.
 3. The system as recited in claim 1,wherein the network-based data classification service is configured to:receive from the local instance of the network-based data classificationservice one or more intermediate results of the classification of thedata at the one or more data sources; process the one or moreintermediate results using a classification model of the network-baseddata classification service to generate one or more classificationresults; and provide the one or more classification results to theclient network.
 4. The system as recited in claim 1, wherein thenetwork-based data classification service is configured to: obtaintraining data from one or more data sources of the client, wherein theone or more data sources include one or more of data sources at theclient network, data sources at the provider network, and data sourcesat another remote network other than the client network; train aclassification model based on the obtained training data; and send thetrained classification model to the local instance of the network-baseddata classification service, wherein the trained classification model isconfigured to be used by the local instance of the network-based dataclassification service to classify data at the client network.
 5. Thesystem as recited in claim 1, wherein the network-based dataclassification service is configured to: transmit updates for aclassification model to the local instance of the network-based dataclassification service, wherein the updates are configured to update aclassification model used by the local instance of the network-baseddata classification service to classify data at the client network.
 6. Amethod, comprising: receiving, via a management interface of anetwork-based data classification service of a provider network, arequest from a remote client network to classify data at one or moredata sources of the client network, wherein the request indicates atleast the one or more data sources; and transmitting to a computingdevice running a local instance of the network-based data classificationservice at the remote client network the request to classify the data atthe one or more data sources, wherein at least some of the data is notexposed outside of a data isolation boundary associated with the clientnetwork during classification of the data by the local instance of thenetwork-based data classification service.
 7. The method as recited inclaim 6, further comprising: receiving via the management interface ofthe network-based data classification service a request from the clientnetwork to provide locations of data sources of the client that havedata that has not yet been classified or is available to be classified;determining a plurality of data sources of the client that each havedata that has not yet been classified or is available to be classified;and providing to the client network an indication of the plurality ofdata sources of the client that each have data that has not yet beenclassified or is available to be classified, wherein the plurality ofdata sources comprises: one or more client data sources located at theprovider network; and one or more client data sources located at theclient network.
 8. The method as recited in claim 7, wherein theindication provided to the client network is based on one or more of: ageographic location of a client device that submitted the request, auser that submitted the request, or a type of the client device thatsubmitted the request.
 9. The method as recited in claim 6, furthercomprising: receiving from the local instance of the network-based dataclassification service one or more intermediate results of theclassification of the data at the one or more data sources; processingthe one or more intermediate results using a classification model of thenetwork-based data classification service to generate one or moreclassification results; and providing the one or more classificationresults to the client network.
 10. The method as recited in claim 6,further comprising: obtaining training data from one or more datasources of the client, wherein the one or more data sources include oneor more of data sources at the client network, data sources at theprovider network, and data sources at another remote network other thanthe client network; training a classification model based on theobtained training data; and sending the trained classification model tothe local instance of the network-based data classification service,wherein the trained classification model is configured to be used by thelocal instance of the network-based data classification service toclassify data at the client network.
 11. The method as recited in claim6, further comprising: receiving via the management interface of thenetwork-based data classification service a request from the clientnetwork to classify other data at one or more other data sources at theprovider network, wherein the request indicates at least the one or moreother data sources; and obtaining at least some of the other data fromthe one or more other data sources of the provider network; andclassifying the obtained other data according to different types ofsensitivity using a data classification engine of the provider network.12. The method as recited in claim 6, further comprising: downloadingfrom the network-based data classification service to the remote clientnetwork a data classification engine and an execution environment to runthe data classification engine within the local instance of thenetwork-based data classification service.
 13. The method as recited inclaim 6, wherein the computing device is provided by a service providerof the network-based data classification service to the client, andfurther comprising: transmitting from the network-based dataclassification service to the computing device a data classificationengine and an execution environment to run the data classificationengine within the local instance of the network-based dataclassification service before the computing device is shipped to theclient.
 14. A non-transitory computer-readable storage medium storingprogram instructions that, when executed by one or more computingdevices of a network-based data classification service of a providernetwork, cause the one or more computing devices to implement:receiving, via a management interface of the network-based dataclassification service, a request from a remote client network toclassify data at one or more data sources of the client network, whereinthe request indicates at least the one or more data sources; andtransmitting to a computing device running a local instance of thenetwork-based data classification service at the remote client networkthe request to classify the data at the one or more data sources,wherein at least some of the data is not exposed outside of a dataisolation boundary associated with the client network duringclassification of the data by the local instance of the network-baseddata classification service.
 15. The computer-readable storage medium asrecited in claim 14, wherein the program instructions cause the one ormore computing devices to implement: receiving via the managementinterface of the network-based data classification service a requestfrom the client network to provide locations of data sources of theclient that have data that has not yet been classified or is availableto be classified; determining a plurality of data sources of the clientthat each have data that has not yet been classified or is available tobe classified; and providing to the client network an indication of theplurality of data sources of the client that each have data that has notyet been classified or is available to be classified, wherein theplurality of data sources comprises: one or more client data sourceslocated at the provider network; and one or more client data sourceslocated at the client network.
 16. The computer-readable storage mediumas recited in claim 14, wherein the program instructions cause the oneor more computing devices to implement: receiving via the managementinterface of the network-based data classification service a requestfrom the client network to discover data sources of the client network;and transmitting to the computing device running the local instance ofthe network-based data classification service the request to discoverdata sources of the client network.
 17. The computer-readable storagemedium as recited in claim 14, wherein the program instructions causethe one or more computing devices to implement: receiving from the localinstance of the network-based data classification service one or moreintermediate results of the classification of the data at the one ormore data sources; processing the one or more intermediate results usinga classification model of the network-based data classification serviceto generate one or more classification results; and providing the one ormore classification results to the client network.
 18. Thecomputer-readable storage medium as recited in claim 14, wherein theprogram instructions cause the one or more computing devices toimplement: obtaining training data from one or more data sources of theclient, wherein the one or more data sources include one or more of datasources at the client network, data sources at the provider network, anddata sources at another remote network other than the client network;training a classification model based on the obtained training data; andsending the trained classification model to the local instance of thenetwork-based data classification service, wherein the trainedclassification model is configured to be used by the local instance ofthe network-based data classification service to classify data at theclient network.
 19. The computer-readable storage medium as recited inclaim 14, wherein the program instructions cause the one or morecomputing devices to implement: transmitting updates for aclassification model to the local instance of the network-based dataclassification service, wherein the updates are configured to update aclassification model used by the local instance of the network-baseddata classification service to classify data at the client network. 20.The computer-readable storage medium as recited in claim 14, wherein theprogram instructions cause the one or more computing devices toimplement: receiving from the local instance of the network-based dataclassification service one or more portions of the data from the datasources and metadata that indicates the one or more portions of the datahas been classified by the local instance of the network-based dataclassification service.